Tagged fintech
23 pieces
- · 10 min read
Accept Is Binding, So Accept Has To Be Idempotent
When a counterparty can accept an executable quote from a phone, the accept action will be repeated. A tap on poor signal that appears to do nothing gets tapped again, clients retry on timeout, and proxies replay. Unless an idempotency key is checked before the state transition is applied, the second attempt creates a second binding trade against someone who believes they agreed once.
- · 10 min read
Settlement And Reporting Are Projections Of One Record, Not Two Systems That Agree
When settlement and reporting each maintain their own copy of what happened, they will eventually disagree and nobody can say which one is right. Derived as projections of a single append-only record of trade transitions, disagreement stops being a bug you chase and becomes structurally impossible. The design question then moves to how a projection is rebuilt without inventing a second history.
- · 7 min read
Read-Only Is Not a Safety Boundary: It Protects Your Data From the Agent, Not Your Users From It
Giving an agent a read-only database role stops it writing. It does nothing about what it can see, because Postgres owner roles and the pg_read_all_data role bypass row-level security by default. If your product's promise is that one party cannot see another party's identity until they release it, that promise has to be enforced in the database, and read-only does not enforce it.
- · 10 min read
Authorise The Object, Not The Screen
A platform that serves public market information and private executable quotes from one state core has to check its boundary against the object being requested, not against the screen that requested it. Per-screen checks pass while an edited identifier in a request reaches another counterparty's private price. Broken object level authorisation sits consistently near the top of published web application risk lists because it is invisible to every test that only drives the user interface.
- · 9 min read
Trust the Webhook, Not the Page: Why Payments Go Missing Between Three Systems That All Report Success
The site, the payment processor and your records each work correctly on their own, and the money that goes missing is lost in the gaps between them. Confirming on the landing page loses every payment where the browser never came back. The processor retries for up to three days, may deliver the same event twice, and guarantees no ordering, so the handler has to be idempotent and the state has to be derived from a ledger rather than incremented on arrival.
- · 10 min read
Clear One Real Transaction Before You Build The Second Feature
For a transactional product, the shortest reliable path to one real settled transaction is worth more than a broad surface built before anything clears. Breadth first means months of work resting on assumptions about payment, settlement and counterparty behaviour that nobody has tested. The narrow path is chosen by following the money, and the scope you defer has to be named rather than quietly omitted.
- · 9 min read
When You Automate the Gatekeeper Away, Every Check They Made By Eye Becomes a Rule You Have to Enforce
A platform that lets a counterparty accept a binding quote without a human looking at it has not removed the gate, it has moved it into code. Every check the trader used to perform by judgement now has to exist as an enforced rule, the binding action has to be idempotent, and the number the engine computes has to equal the number the human would have produced, to the cent. The rounding trap that makes a parity test agree with itself is the one that costs money.
- · 10 min read
Sync The Commercial Record From Day One, And Make The Sync Idempotent
When a platform transacts and a separate system holds the customer relationship, retro-fitting the sync between them costs far more than building it with the first transaction. The integration has to be idempotent from the start, because a duplicate contact or a duplicate deal is a commercial problem rather than a technical curiosity. Most of the work is deciding which system owns which fact, before any data moves.
- · 8 min read
The Number Someone Signs: Rebuild It by Rule, Do Not Read It Off the Document
When a person certifies a figure your system produced, extraction accuracy is the wrong metric. The document your pipeline reads can be perfectly extracted and still contain a total that must not be claimed, because a rule outside the document excludes part of it. The deliverable is a figure rebuilt by classification from the line items, with each charge categorised, and scored against what was actually filed rather than against what was extracted.
- · 10 min read
Moving An Allocation Is A Transition, Not An Edit To Two Quantities
Shifting an allocation from one commitment to another moves real exposure, so it has to be recorded as its own transition with its own entry. Implemented as an edit to two numbers it leaves nothing to reconstruct, which means the move cannot be explained when it is challenged and cannot be made safe when two people do it at once. The operation is the record, not the resulting quantities.
- · 10 min read
A Correction Is An Entry, Never An Edit
An administrative correction applied by editing a figure destroys the ability to reconstruct how that figure reached its value, and it hides the fact that a correction happened at all. Recorded as its own entry, with a reason and an author, the balance still derives from the entries and the correction stays visible to everyone who later asks why the number moved. The hard part is the reason, not the arithmetic.
- · 10 min read
Fresh, Entitled And Real Are Three Properties With Three Mechanisms
A number shown to somebody who will be held accountable for it has to be fresh, entitled and real. Fresh needs an alarm that fires on absence. Entitled needs a check at the moment of presentation. Real needs a traceable source and an abstain path when the trace is missing. A system that treats these as one concern satisfies whichever is easiest and fails the other two silently.
- · 10 min read
Page On Silence, Not Only On The Value
A feed that stops sends no out-of-range value, so a threshold alarm has nothing to fire on and the last good number keeps being served as though it were current. The only thing that catches this is a second alarm lane whose condition is the absence of data by an expected cadence. It is the most commonly missing alarm in a monitoring setup, because every other alarm is written against something arriving.
- · 11 min read
Model the Trade, Not the Screens
When quote, acceptance and settlement exist as three screens calling services ad hoc, the acceptance and the trade record can disagree, and a double tap can execute twice. An explicit state machine with defined transitions makes the impossible combination unrepresentable rather than merely unlikely. An append-only record of transitions lets settlement and reporting be projections of one history instead of two copies that drift apart.
- · 10 min read
Positions, Not Stock Levels: What Changes When the Operator Is the Counterparty
An operator who buys and sells on their own book is not an intermediary moving other people's goods. What they hold is exposure, and exposure is not a quantity. A warehouse model tracking units in and units out loses the exposure view entirely, and turns a reallocation into an untraceable edit to two numbers. Modelling positions explicitly, with allocation and reallocation recorded as transitions, lets the book explain itself.
- · 10 min read
Restaurant AI Fails on Three Numbers
Sales, labour and cost of goods each mean something specific in food and beverage, and a generalist gets all three wrong in directions that look plausible. Sales taken gross rather than net of comps, voids and discounts. Labour taken as wages rather than burdened with taxes and benefits. Cost of goods recognised from a stock count rather than from consumption, so product sitting in the walk-in is treated as sold. If the figures do not tie back to the source systems, no insight should be produced.
- · 9 min read
Two Code Paths During a Strangler Migration
Incremental replacement behind an existing system means two implementations coexist for the whole migration, with a routing seam between them. That is a real cost rather than a detail. Routing rules, shared state, sessions that cross the boundary and the criteria for declaring a path finished all have to be designed up front, because the alternative is discovering the seam's behaviour from incidents.
- · 6 min read
Exactly-Once in Effect Is Not Exactly-Once, and the Difference Is Where Your Ledger Stops
Deduplicating on an event identifier and deriving state from an append-only ledger gives you exactly-once behaviour over an at-least-once unordered stream. That is the strongest thing available and it rests on one assumption: that the identifier is a sound deduplication key. Name the assumption, because the cases where it fails are real and the backstop is reconciliation rather than the handler.
- · 11 min read
Withhold the Insight When It Does Not Reconcile
An operator reading a figure cannot tell a reconciled number from an unreconciled one, so a plausible narrative over numbers that do not tie back is indistinguishable from a correct one. Silence is the correct output. Reconciliation therefore has to be a gate in the pipeline rather than a report consulted afterwards, which means designing what the product shows when it shows nothing.
- · 6 min read
Knight Capital: A 460 Million Dollar Deploy With No Consistency Check
A technician copied new code to eight servers by hand and one did not receive it. A repurposed feature flag then reactivated dormant routing logic on that one server. Roughly 4 million executions in 45 minutes, and no control existed that would have gone red on the divergence.
- · 7 min read
Reconciliation Is Not a Nice-to-Have
Prevention mechanisms fail silently. Reconciliation is the only part of a money-moving system that can tell you they did, and it is the component most often deferred, because it produces no feature and its value is invisible on every day it finds nothing.
- · 7 min read
Idempotency for Money Movement
An idempotency key is not a header you add. It is a claim about what constitutes the same operation, and almost every double-charge traces to that claim being wrong: the key was generated per attempt instead of per intent, or the deduplication window closed before the retry arrived, or the key covered the request and not the effect.
- · 7 min read
Agents Take Actions That Can't Be Undone: Designing for Irreversibility
A chatbot writes words, and if it is wrong you delete it. An agent acts: it sends the email, charges the card, deletes the record, places the order, and those actions turn one way at machine speed. In 2012 an automated trading system shipped a bad deployment with no kill switch and lost 440 million dollars in about five minutes. The code was the last domino. The failure was the system that let it run with no brakes.